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DETAILED ACTION 

1 . Claims 1-2, 6-7, 14 and 22-32 have been examined. 

Response to Amendment/Argument 

2. The Applicant's amendment, filed 14 July 2008, has been received, entered into 
the record, and respectfully and carefully considered. 

3. As a result of the amendment, claims 1 , 5-1 0, 1 2-1 4, 23 and 32 have been 
amended. Claims 3-4, 1 1 and 15-21 are canceled. Claims 33-40 are newly added 
claims. Thus, claims 1-2, 5-10, 12-14 and 22-40 are pending. 

4. Any objection/rejections not repeated below for record are withdrawn due to 
Applicant's amendment. 

5. Applicant's amendments and argument have been fully considered, but are 
moot in view of new ground rejection as set forth below. 

6. After previous non-final Office Action (14 April 2008) mailed out, new clarification 
of "Process" under 35 USC 1 01 in view of the Court of Appeals for the Federal Circuit in 
In re Bilski, Appeal No. 2007-1 130 was provided to the examiner and the public in May, 
2008. After careful review of method claims 1-2, 6-7, 14, 22, 30 and 32 of the instant 
application in view of In re Bilski, the examiner believes claims 1-2, 6-7, 14, 22, 30 and 
32 are not statutory. Since claims 1-2, 6-7, 14, 22, 30 and 32 were not rejected under 
35 USC 101 in view of In re Bilski in the previous Office Action, the examiner rejects 
claims 1-2, 6-7, 14, 22, 30 and 32 under 35 USC 101 in the current Office Action and 
the current Office Action is Non-final. 
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Election/Restrictions 

7. Applicant's election without traverse of electing Group I (claims 1-2, 6-7, 14 and 
22-32), in the reply filed on 23 December 2008 is acknowledged. 

Since the Applicant did not state no-elected Group II (claims 5, 8-1 0, 1 2-1 3 and 
33-40) is withdrawn or canceled, Group II (claims 5, 8-10, 12-13 and 33-40) is hereby 
withdrawn from consideration and claims 1-2, 6-7, 14 and 22-32 have been examined. 

Information Disclosure Statement 

8. The information disclosure statement filed 9 April 2007 fails to comply with 37 
CFR 1 .98(a)(3) because German Office action does not include a concise explanation 
of the relevance, as it is presently understood by the individual designated in 37 CFR 

1 .56(c) most knowledgeable about the content of the information, of each patent listed 
that is not in the English language. It has been placed in the application file, but the 
information referred to therein has not been considered. 

Specification 

9. The specification is objected to as failing to provide proper antecedent basis for 
the claimed subject matter. See 37 CFR 1.75(d)(1) and MPEP § 608.01 (o). Correction 
of the following is required: "computer-readable storage medium" in claims 14 and 23, 
lacks antecedent basis in the specification. 
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Claim Objections 

10. Claims 1-2, 6-7, 14 and 32 are objected to because of the following informalities: 

As per claim 1, "an electronic data processing method method" is being 
recited in the preamble. Please remove one "method" from the preamble. 

Further, "selecting a user group identifier and acquiring at least one data 
key associated therewith from a centralized data store including all available 
keys, at least one user group identifier and at least one data key being 
associated with one another" is being recited. However, this newly added claim 
limitation is grammatically incomprehensible. Please clarify. In order to further 
exam on the merits of this claim, the examiner assumes "at least one user group 
identifier" refers to "selecting a user group identifier" and "at lest one data key" 
refers to "acquiring at least one data key". 

Any claim not specifically addressed, above, is being objected as 
incorporating the deficiencies of a claim upon which it depends. 

Appropriate correction is required. 

Claim Rejections - 35 USC § 101 

11. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

12. Claims 1-2, 6-7, 14, 22-30 and 32 are rejected under 35 U.S.C. 101 because the 
claimed invention is directed to non-statutory subject matter. 
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Claims 1-2, 6-7, 14, 22-30 and 32 are rejected under 35 U.S.C. 101 as not 

falling within one of the four statutory categories of invention. While the claims recite a 
series of steps or acts to be performed, a statutory "process" under 35 U.S.C. 101 must 
(1) be tied to particular machine, or (2) transform underlying subject matter (such as an 
article or material) to a different state or thing. See page 10 of In Re Bilski 88 USPQ2d 
1385. The instant claim is neither positively tied to a particular machine that 
accomplishes the claimed method steps nor transforms underlying subject matter, and 
therefore do not qualify as a statutory process. The method recited in claims 1-2, 6-7, 
14, 22-30 and 32, such steps of performing a security check, associating the user 
identity, selecting a user group identifier and performing encrypting and decrypting data 
are broad enough that the claim could be completely performed manually, mentally, 
verbally or without a machine. Further, although a centralized data store is being 
recited, it can be reasonably interpreted as database, which is software per se and 
selecting a user group identifier from a centralized data store can be completely 
performed manually by a human user. Furthermore, a centralized data store is not 
required in the performing of the step and therefore is neither an explicitly recited 
structural tie or inherently involved in the step. Therefore, claims 1-2, 6-7, 14, 22-30 and 
32 do not define a statutory process. 

Claim Rejections - 35 USC § 103 

1 3. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 
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(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

14. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

1 5. This application currently names joint inventors. In considering patentability of 
the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 
the various claims was commonly owned at the time any inventions covered therein 
were made absent any evidence to the contrary. Applicant is advised of the obligation 
under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 
not commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 1 03(a). 

16. Claims 1, 2, 6, 7, 14 and 22-32 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Deindl et al. (U.S. Patent No. 6,031 ,91 0) in view of Sasaki (U.S. 
Patent No. 7,272,230). 

As per claim 1, Deindl et al. discloses an electronic data processing method, 
comprising: 
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performing a security check to ascertain a user identity by comparing 
entered identity information with stored user identity data (e.g. col. 6, lines 33-43); 

associating the user identity with a user identifier (personal identification 
number, a password and/or biometric identification - e.g. col. 6, lines 37-39. Please 
note personal identification number, a password and/or biometric identification 
corresponds to Applicant's user identifier); 

associating the user identifier with at least one user group identifier (e.g. 
col. 6, lines 22-23 and 44-56); 

selecting a user group identifier and at least one user group identifier and 
at least one data key being associated with one another (e.g. col. 6, lines 20-32); 

performing at least one of encrypting and decrypting data using the 
acquired at least one data key and inhibiting user recognition of the acquired at least 
one data key (generating one or more cryptographic keys in the chip card for use by a 
computer... encrypting at least one of cryptographic keys in the chip card with a second 
cryptographic key" - e.g. col. 6, lines 23-32 and "encrypting at least one set of data by 
means of the cryptographic keys in the computer" - e.g. col. 6, lines 26-28. Please note 
the one or more cryptographic keys reside on the chip card and they are encrypted. 
Therefore, the keys are unviewable by the user). 

Although Deindl et al. further discloses the encrypted data and the associated 
key are stored together in one file, e.g. in a computer, in a database, or is distributed 
over a network, Deindl et al. does not explicitly disclose selecting a user group identifier 
and at least one user group identifier and acquiring the data key from a centralized data 
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store including all available keys, at least one data key being associated with one 
another. However, Sasaki met the claimed limitation by disclosing a second 
management database 16 includes a "group ID" and a corresponding "group key" in fig. 
31 and when the obtained group ID is registered, so that a group key corresponding to 
the group ID is read out (e.g. second management database 16 in fig. 31, col. 29, lines 
5-1 1 , col. 7, line 53 - col. 8, line 9 and col. 32, lines 3-10). 

Deindl et al. - Sasaki are analogous art because they are from a similar 
field of endeavor in data protection through encryption/decryption. Thus, it would 
have been obvious to a person with ordinary skill in the art, at the time of 
invention, to modify the teachings of Deindl et al. with selecting a user group 
identifier and at least one user group identifier and acquiring the data key from a 
centralized data store including all available keys, at least one data key being 
associated with one another taught by Sasaki in order to provide centralized key 
management in a cryptographic system. 

This combination would predictably result a well known centralized 
database to retrieve group keys corresponding to group identifiers. It has been 
held that "[t]he combination of familiar elements according to known methods is 
likely to be obvious when it does not more than yield predictable results." KSR., 
127 S. Ct. at 1739, 82USPQ2d at 1395 (2007) (citing Graham, 383 U.S. at 12). 
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As per claim 2, Deindl et al. further discloses wherein the security check involves 
at least one of checking a user-specific biometric data, an electronic key and a 
mechanical key (e.g. col. 6, lines 33-43). 

As per claim 6, Deindl et al. further discloses wherein a plurality of data keys are 
simultaneously assignable to one user identifier (e.g. col. 6, lines 23-25). 

As per claim 7, Deindl et al. - Sasaki further discloses wherein the data are 
medically relevant, wherein the users include personnel within a medical facility, and 
wherein common user group identifiers are assigned the same data key (e.g. col. 7, 
lines 57-63 of Deindl et al. and col. 7, lines 59 -62 of Sasaki). 

As per claim 14, Deindl et al. - Sasaki discloses the claimed method of steps as 
applied above in claim 1 . Therefore, Deindl et al. - Sasaki discloses the claimed 
information stored on a storage medium for carrying out the method of steps. 

As per claim 32, Deindl et al. - Sasaki further discloses wherein users associated 
with a common user group are assigned the same data key (e.g. col. 7, lines 57-63 of 
Deindl et al. and col. 7, lines 59 -62 of Sasaki). 

As per claims 22 and 31, they are rejected using the similar rationale as 
rejecting claim 1 above. Please note Deindl et al. - Sasaki discloses the same data key 
being assignable to the plurality of users (e.g. col. 7, lines 57-63 of Deindl et al. and col. 
7, lines 59 -62 of Sasaki) 
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As per claim 23, Deindl et al. - Sasaki discloses the claimed method of steps as 
applied above in claim 22. Therefore, Deindl et al. - Sasaki discloses the claimed 
information stored on a storage medium for carrying out the method of steps. 

As per claim 24, Deindl et al. further discloses wherein the security check 
involves checking biometric data of the user (e.g. col. 6, lines 33-43). 

As per claim 25, Deindl et al. further discloses wherein the security check 
involves checking a user-specific at least one of electronic and mechanical key ("In 
reading a file the doctor must be in possession of a user card 310. The user card 310 
legitimizes the doctor as an authorized doctor in a particular specialty - e.g. col. 4, lines 
53 -55 and col. 7, lines 57-63. Please note a doctor's user card corresponds to 
Applicant's a user-specific at least one of electronic and mechanical key). 

As per claims 26-27, Deindl et al. further discloses wherein the data key is 
ascertained by comparing the data obtained in the security check with content of a data 
key memory and wherein the data obtained in the security check are compared with the 
content of the data key memory using a data telecommunication device (e.g. col. 4, 
lines 26-36 and col. 4, lines 53-67). 

As per claim 28, Deindl et al. further discloses wherein a plurality of data keys 
are simultaneously assignable to one user (e.g. col. 6, lines 23-25). 

As per claims 29 and 30, Deindl et al. further discloses wherein the data are 
medically relevant, wherein the users include personnel at a medical facility, and 
wherein common user groups are assigned the same data key (e.g. col. 7, lines 57-63). 
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Conclusion 

1 7. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. However, applicants are strongly urged to consider the cited 
references carefully and distinguish them from the instant claims in accordance with 
37CFR 1 .1 1 1c when presenting an amendment in response to the current Office Action. 

> Swanke et al. (U.S. Patent No. 7,212,987) discloses acquiring a key from a 
central database 

> Persson et al. (U.S. Pub. No. 2007/0055877) teaches using a group key as 
an index to retrieve a trusted group key 
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Contact Information 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to APRIL Y. SHAN whose telephone number is (571)270- 
1014. The examiner can normally be reached on Monday - Friday, 8:00 a.m. - 5:00 
p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on (571) 272-3859. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/April Y Shan/ 
Examiner, Art Unit 2435 
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